# Get refresh token **URL:** \ **Category:** API & Developers\ **Created:** [13 April 2018 20:47 UTC](https://forum.asana.com/t/get-refresh-token/19916 "2018-04-13T20:47:51Z")\ **Posts on this page:** 17\ **Page:** 1
**Author:** ![Bastien\_Siebman](https://sea2.discourse-cdn.com/asana/user_avatar/forum.asana.com/bastien_siebman/32/172354_2.png) [@Bastien\_Siebman](https://forum.asana.com/u/Bastien_Siebman)\ **Post date:** [13 April 2018 20:47 UTC](https://forum.asana.com/t/get-refresh-token/19916/1 "2018-04-13T20:47:51Z")
Hi, I can’t get the syntax right. How can I get the refresh token using the node API? I have an access token from the OAuth callback though. Thanks! cc @Diakoptis ---
**Author:** ![Siva\_Subramanian](https://sea2.discourse-cdn.com/asana/user_avatar/forum.asana.com/siva_subramanian/32/9593_2.png) [@Siva\_Subramanian](https://forum.asana.com/u/Siva_Subramanian)\ **Post date:** [17 April 2018 11:24 UTC](https://forum.asana.com/t/get-refresh-token/19916/2 "2018-04-17T11:24:34Z")
I’m facing the same issue. I fetch the bearer token from OAuth callback. but can’t get the refresh token. ---
**Author:** ![Diakoptis](https://sea2.discourse-cdn.com/asana/user_avatar/forum.asana.com/diakoptis/32/22726_2.png) [@Diakoptis](https://forum.asana.com/u/Diakoptis)\ **Post date:** [17 April 2018 11:56 UTC](https://forum.asana.com/t/get-refresh-token/19916/3 "2018-04-17T11:56:29Z")
Sry guys i’m late. Check this: [PHP API, Oauth2 workflow - #6 by Diakoptis](https://forum.asana.com/t/php-api-oauth2-workflow/8007/6) ---
**Author:** ![Diakoptis](https://sea2.discourse-cdn.com/asana/user_avatar/forum.asana.com/diakoptis/32/22726_2.png) [@Diakoptis](https://forum.asana.com/u/Diakoptis)\ **Post date:** [17 April 2018 11:57 UTC](https://forum.asana.com/t/get-refresh-token/19916/4 "2018-04-17T11:57:49Z")
@Bastien_Siebman i haven’t use node api ☹ ---
**Author:** ![Siva\_Subramanian](https://sea2.discourse-cdn.com/asana/user_avatar/forum.asana.com/siva_subramanian/32/9593_2.png) [@Siva\_Subramanian](https://forum.asana.com/u/Siva_Subramanian)\ **Post date:** [19 April 2018 04:06 UTC](https://forum.asana.com/t/get-refresh-token/19916/5 "2018-04-19T04:06:07Z")
@Diakoptis Thank you for your response. I use this Api to fetch refresh token. But it fails everytime. What should i pass in the request body? is there any format? [https://app.asana.com/-/oauth\_token?client\_id=](https://app.asana.com/-/oauth_token?client_id=)" + ASANA\_CLIENT\_ID + "&redirect\_uri=[http://localhost:3000/auth/asana/callback&response\_type=code](http://localhost:3000/auth/asana/callback&response_type=code) ---
**Author:** ![Diakoptis](https://sea2.discourse-cdn.com/asana/user_avatar/forum.asana.com/diakoptis/32/22726_2.png) [@Diakoptis](https://forum.asana.com/u/Diakoptis)\ **Post date:** [19 April 2018 05:25 UTC](https://forum.asana.com/t/get-refresh-token/19916/6 "2018-04-19T05:25:48Z")
Try this: https:// [app.asana.com/-/oauth\_token?grant\_type=refresh\_token](http://app.asana.com/-/oauth_token?grant_type=refresh_token)’ + ‘&client\_id=’ + client\_id + ‘&client\_secret=’ + client\_secret + ‘&refresh\_token=’ + refresh\_token ---
**Author:** ![Bastien\_Siebman](https://sea2.discourse-cdn.com/asana/user_avatar/forum.asana.com/bastien_siebman/32/172354_2.png) [@Bastien\_Siebman](https://forum.asana.com/u/Bastien_Siebman)\ **Post date:** [19 April 2018 22:10 UTC](https://forum.asana.com/t/get-refresh-token/19916/7 "2018-04-19T22:10:22Z")
I will try when I have the time, thanks a lot ---
**Author:** ![Bastien\_Siebman](https://sea2.discourse-cdn.com/asana/user_avatar/forum.asana.com/bastien_siebman/32/172354_2.png) [@Bastien\_Siebman](https://forum.asana.com/u/Bastien_Siebman)\ **Post date:** [22 April 2018 13:50 UTC](https://forum.asana.com/t/get-refresh-token/19916/8 "2018-04-22T13:50:16Z")
@Diakoptis the given url includes the refresh token while I am stuck without a refresh token at all 😛 I don’t understand how to get it. I think I am going to reverse engineer the PHP library that allows it… ---
**Author:** ![Bastien\_Siebman](https://sea2.discourse-cdn.com/asana/user_avatar/forum.asana.com/bastien_siebman/32/172354_2.png) [@Bastien\_Siebman](https://forum.asana.com/u/Bastien_Siebman)\ **Post date:** [22 April 2018 13:54 UTC](https://forum.asana.com/t/get-refresh-token/19916/9 "2018-04-22T13:54:26Z")
FYI to login the library makes a request to `https://app.asana.com/-/oauth_authorize?client_id=XXXX&response_type=token&redirect_uri=XXXX&scope=default&state=XXXX` and as a result I get `access_token=XXXXX&token_type=bearer&expires_in=3600&data=&state=XXX` ---
**Author:** ![Bastien\_Siebman](https://sea2.discourse-cdn.com/asana/user_avatar/forum.asana.com/bastien_siebman/32/172354_2.png) [@Bastien\_Siebman](https://forum.asana.com/u/Bastien_Siebman)\ **Post date:** [22 April 2018 13:57 UTC](https://forum.asana.com/t/get-refresh-token/19916/10 "2018-04-22T13:57:08Z")
I am using the Implicit Grant workflow… ---
**Author:** ![Bastien\_Siebman](https://sea2.discourse-cdn.com/asana/user_avatar/forum.asana.com/bastien_siebman/32/172354_2.png) [@Bastien\_Siebman](https://forum.asana.com/u/Bastien_Siebman)\ **Post date:** [22 April 2018 14:00 UTC](https://forum.asana.com/t/get-refresh-token/19916/11 "2018-04-22T14:00:01Z")
According to this page [Implicit Grant — OAuthLib 3.2.2 documentation](http://oauthlib.readthedocs.io/en/latest/oauth2/grants/implicit.html) refresh token are not supported with Implicit Workflow, I will have to do a workaround 😛 ---
**Author:** ![Matt\_Bramlage](https://sea2.discourse-cdn.com/asana/user_avatar/forum.asana.com/matt_bramlage/32/145_2.png) [@Matt\_Bramlage](https://forum.asana.com/u/Matt_Bramlage)\ **Post date:** [23 April 2018 18:54 UTC](https://forum.asana.com/t/get-refresh-token/19916/12 "2018-04-23T18:54:56Z")
Hi all, sorry I’m a bit late to the game, but you seem to be getting it sorted 🙂 The general issue here is that there are 2 types of OAuth authorization workflows: “Authorization Code Grant” and “Implicit Grant”, and unfortunately while standard, those names don’t give many clues as to what each flow means… “Authorization Code Grant” is intended to allow a server that has the capacity to securely store secrets to get a long-lived capability for accessing an API. The refresh token is the key here, because it is what is used to grant long-lived access to the API (and is therefore an important thing to keep secret). This is the flow with `response_type=code` as the request parameter. The way this flow works is: - The app is given a secret credential called the `client_secret` when it is created. Users should never see this. - A user wishes to authorize the app, and gives it access to do so at [Log in - Asana](https://app.asana.com/-/oauth_authorize). The response contains a code in the URL parameter that the browser is redirected to. - The app uses this code, representing “this user did say it was OK to access their data for this app just now”, _and_ the app’s `client_secret` which identifies that this is indeed the correct app, to get a long-lived `refresh_token`. The user also should never see the refresh token. - Refresh tokens can be used in perpetuity to get access to short-lived access tokens via [https://app.asana.com/-/oauth\_token](https://app.asana.com/-/oauth_token). These short-lived tokens are the ones passed in the header to actually grant access. The above flow presumes that the app can store both its own client\_secret and the refresh\_token per-user in a secure location that users (and, say, snoopy browser extensions) don’t have access to. If this is not true, it’s recommended to use the “Implicit Grant” flow with `response_type=token`. That is a simpler (but unfortunately more user-impacting) way to access an API: - Show the user the same sort of authorization grant via [Log in - Asana](https://app.asana.com/-/oauth_authorize) - Instead of a code to get access to a long-lived token, a short-lived token is given directly in the redirect via a URL parameter. This token can be used to access the API for an hour. - After that time expires, repeat this flow to get another short-lived token. So more or less, the price that’s paid to have a purely in-browser (and therefore inherently hard to secure) application is that the user will explicitly have to keep reauthorizing the app every hour or so. This is basically because OAuth was written with server-to-server authentication in mind, and browser-to-server auth is basically impossible to completely secure, since users and browser extensions have the capability to snoop into any client side storage 😕 ---
**Author:** ![Bastien\_Siebman](https://sea2.discourse-cdn.com/asana/user_avatar/forum.asana.com/bastien_siebman/32/172354_2.png) [@Bastien\_Siebman](https://forum.asana.com/u/Bastien_Siebman)\ **Post date:** [23 April 2018 19:10 UTC](https://forum.asana.com/t/get-refresh-token/19916/13 "2018-04-23T19:10:38Z")
Thank you so much with all the details! It is very clear now 😘 ---
**Author:** ![Anton\_Striapan](https://luna1.co/8d76cd.png) [@Anton\_Striapan](https://forum.asana.com/u/Anton_Striapan)\ **Post date:** [28 March 2021 16:38 UTC](https://forum.asana.com/t/get-refresh-token/19916/14 "2021-03-28T16:38:08Z")
Hi, I tried your solution to use this, but I’m getting “The user has revoked authorization.” error, Do you have thoughts what can it be? ---
**Author:** ![MacForrester](https://luna1.co/8d76cd.png) [@MacForrester](https://forum.asana.com/u/MacForrester)\ **Post date:** [28 October 2021 14:28 UTC](https://forum.asana.com/t/get-refresh-token/19916/15 "2021-10-28T14:28:07Z")
> [@Matt\_Bramlage](#): > > Refresh tokens can be used in perpetuity to get access to short-lived access tokens via [https://app.asana.com/-/oauth\_token](https://app.asana.com/-/oauth_token). These short-lived tokens are the ones passed in the header to actually grant access. Hi, i am trying to get refresh tokens for my python app according to the sparse information of the API doc, but i just can’t get it to work. How do you do it? Can we just get a code example? Another user also suggested using auto refresh, but this doesn’t seem to work… ---
**Author:** ![Bastien\_Siebman](https://sea2.discourse-cdn.com/asana/user_avatar/forum.asana.com/bastien_siebman/32/172354_2.png) [@Bastien\_Siebman](https://forum.asana.com/u/Bastien_Siebman)\ **Post date:** [28 October 2021 14:42 UTC](https://forum.asana.com/t/get-refresh-token/19916/16 "2021-10-28T14:42:26Z")
I don’t have a working example but when I tried it was hard 😅 ---
**Author:** ![system](https://sea2.discourse-cdn.com/asana/user_avatar/forum.asana.com/system/32/276370_2.png) [@system](https://forum.asana.com/u/system)\ **Post date:** [30 May 2025 19:05 UTC](https://forum.asana.com/t/get-refresh-token/19916/17 "2025-05-30T19:05:01Z")